Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent app-design artifact generator with disclosed local file outputs and optional OpenAI image generation.
Install only if you are comfortable with the optional AI image step sending page names and design constraints from your approved feature document to OpenAI. Use the non-API prompt-package path if the document contains sensitive product details or you do not want external model calls.
The workflow instructs the skill to always generate feature documents in Chinese and English, and later validation requires both zh-CN and en-US docs. This imposes specific locales by default rather than offering them as an explicit user choice, which conflicts with the language/locale policy criteria.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def ai_image(prompt: str, api_key: str, size: str = "1536x1024"):
url = "https://api.openai.com/v1/images/generations"
payload = {
"model": "gpt-image-1",
"prompt": prompt,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
req.add_header("Authorization", f"Bearer {api_key}")
req.add_header("Content-Type", "application/json")
data = json.dumps(payload).encode("utf-8")
with urllib.request.urlopen(req, data=data, timeout=180) as r:
body = json.loads(r.read().decode("utf-8"))
b64 = body["data"][0]["b64_json"]
return base64.b64decode(b64)
This code performs a network request to the OpenAI image API using a prompt built from the contents of the user-supplied feature document. While the argument parser description mentions AI generation, there is no explicit runtime warning, confirmation, or comment near the request making it clear that document content is transmitted to an external service.